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IN THE CLAIMS 

This listing of claims will replace all prior versions, and listings, of claims in the 
application. 

Please amend the claims as follows: 

1. (Currently Amended) A computer-implemented method comprising: 
maintaining a plurality of stored signatures in a data storage device, each signature 

being associated with one of a plurality of registered documents; 

intercepting packets being transmitted over a network between a source and a 

destination; 

reassembling the packets into an intercepted complete flow, wherein the intercepted 
complete flow represents an ordered data stream of a communication between the source and 
the destination; 

extracting a reassembled object from the intercepted complete flow to determine a 
content type of the reassembled object; 

calculating a set of signatures associated with the reassembled object based on the 
content typo ; and 

comparing the set of signatures associated with the reassembled object with the 
plurality of stored signatures to determine if the reassembled object contains content 
associated with a registered document, wherein each registered document is associated with a 
user that requested registration of the document, the user being alerted if an attempt to 
transmit the registered document over a network is made. 



2. (Cancelled) 



ATTORNEY DOCKET NO. 
06897. P007 
Confirmation No. 8137 



PATENT APPLICATION 
10/815,239 



4 



3. (Previously Presented) The method of claim 1, further comprising, if the 
comparison results in a match of at least one of the signatures in the set of signatures with one 
or more of the plurality of stored signatures, then detecting registered content from the 
registered document being contained in the reassembled object. 

4. (Cancelled) 

5. (Previously Presented) The method of claim 3, further comprising halting 
delivery of the intercepted complete flow. 

6. (Previously Presented) The method of claim 5, further comprising prompting the 
user that requested registration of the registered document for permission to deliver the 
intercepted complete flow, receiving permission from the user, and completing delivery of the 
intercepted complete flow in response to receiving permission. 



7. (Previously Presented) The method of claim 1, wherein calculating the set of 
signatures of the reassembled object comprises calculating a plurality of hashes over one or 
more portions of the reassembled object. 
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8. (Currently Amended) An apparatus comprising: 

a network interface module to connect the apparatus to a network; 

a signature database to store a first set of signatures, the first set of signatures being 
associated with a registered object, wherein the first set of signatures stored in the signature 
database is associated with a user who requested registration of the registered object; 

an object capture module to intercept packets being transmitted over the network 
between a source and a destination; 

an object assembly module to reassemble the packets into an intercepted complete 
flow, wherein the intercepted complete flow represents an ordered data stream of a 
communication between the source and the destination; 

an object classification module to extract a reassembled object from the intercepted 
complete flow to determine a content type of the reassembled object; and 

a registration module comprising a registration engine to generate a second set of 
signatures based on the content typo , the second set of signatures being associated with the 
reassembled object, and a search engine to compare the second set of signatures with the first 
set of signatures, the apparatus being configured to alert the user if an attempt to transmit the 
registered object over a network is made. 

9. (Cancelled) 

10. (Previously Presented) The apparatus of claim 8, wherein the registration 
module detects registered content from the registered object being transmitted over the 
network if the search engine matches one or more signatures in the second set of signatures 
with one or more signatures in the first set of signatures. 
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11. (Previously Presented) The apparatus of claim 10, wherein the registration 
module further comprises a notification module to generate an alert for the user who 
requested registration of the registered object in response to detecting registered content from 
the registered object being transmitted over the network. 

12. (Previously Presented) The apparatus of claim 8, further comprising an object 
store module to store the reassembled object. 

13. (Previously Presented) The apparatus of claim 12, wherein the registration 
module halts delivery of the intercepted complete flow from the object store module to 4ts the 
destination in response to detecting registered content from the registered object being 
transmitted over the network. 

14. (Previously Presented) The apparatus of claim 13, wherein the registration 
module allows completion of the delivery of the intercepted complete flow from the object 
store module to the destination in response to receiving permission from the user who 
requested registration of the registered object. 

15. (Previously Presented) The apparatus of claim 8, wherein the registration engine 
generates the second set of signatures by calculating a plurality of hashes over various portions 
of the reassembled object. 
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16. (Currently Amended) A machine-readable medium storing a sequence of 
instructions that, when executed by a processor, cause the processor to perform operations 
comprising: 

maintaining a plurality of stored signatures in a data storage device, each signature 
being associated with one of a plurality of registered documents, wherein each registered 
document is associated with a user that requested registration of the document; 

intercepting packets being transmitted over a network between a source and a 
destination; 

reassembling the packets into an intercepted object complete flow, wherein the 
intercepted complete flow represents an ordered data stream of a communication between the 
source and the destination; 

extracting a reassembled object from the intercepted complete flow to determine a 
content type of the reassembled object; 

calculating a set of signatures associated with the reassembled object based on tho 
content typo ; 

comparing the set of signatures associated with the reassembled object with the 
plurality of stored signatures to determine if the reassembled object contains content 
associated with a registered document; and 

alerting the user if an attempt to transmit the registered document over a network is 

made. 



17. (Cancelled) 
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18. (Previously Presented) The machine-readable medium of claim 16, wherein the 
instructions further cause the processor to detect registered content from the registered 
document being contained in the reassembled object, if the comparison results in a match of at 
least one of the signatures in the set of signatures with one or more of the plurality of stored 
signatures. 

19. (Previously Presented) The machine-readable medium of claim 18, wherein the 
instructions further cause the processor to halt delivery of the reassembled object. 

20. (Cancelled) 

21. (Previously Presented) The machine-readable medium of claim 19, wherein the 
instructions further cause the processor to prompt the user that requested registration of the 
registered document for permission to deliver the reassembled object, and to deliver the 
intercepted complete flow if permission is given. 

22. (Cancelled) 

23. (Cancelled) 

24. (Previously Presented) The computer-implemented method of claim 1, wherein 
the intercepted complete flow includes a plurality of reassembled objects. 

25. (Previously Presented) The apparatus of claim 8, wherein the intercepted 
complete flow includes a plurality of reassembled objects. 



26. (Previously Presented) The machine-readable medium of claim 16, wherein the 
intercepted complete flow includes a plurality of reassembled objects. 



